Secure Civil Navigation and Timing Todd Humphreys | Aerospace Engineering The University of Texas at Austin MITRE | July 20, 2012

University of Texas Radionavigation Lab graduate students Jahshan Bhatti, Kyle Wesson, Ken Pesyna, Zak Kassas, and Daniel Shepard Mark Psiaki, Brady O’Hanlon, Ryan Mitch (Cornell) Brent Ledvina (Coherent Navigation) Aaron Fansler (Northrop Grumman) Acknowledgements

UTC Hours Meters Error 4:00 AM May 2, 2000

GPS Jammers

GPS Spoofer

iPhone Video

University of Texas Spoofing Testbed

Internet or LAN Receive AntennaExternal Reference Clock Control Computer GPS Spoofer UAV coordinates from tracking system Transmit Antenna Spoofed Signals as a “Virtual Tractor Beam” Target UAV Commandeering a UAV via GPS Spoofing

UAV Video

RAIM was helpful for spoofing: we couldn’t spoof all signals seen by UAV due to our reference antenna placement, but the Hornet Mini’s uBlox receiver rejected observables from authentic signals, presumably via RAIM Overwhelming power is required for clean capture: A gradual takeover leads to large ( m) multipath-type errors as the authentic and counterfeit signals interact The UAV’s heavy reliance on altimeter for vertical position was easily overcome by a large vertical GPS velocity Surprises (1/2)

Not possible even to station keep with a captured UAV based on visual position estimates: GPS capture breaks flight controller’s feedback loop; now spoofer must play the role formerly assumed by GPS. Implication: An accurate radar or LIDAR system would be required for fine “control” of UAV via spoofing Compensating for all system and geometric delays to achieve meter-level alignment is challenging but quite possible In high-stakes situations, graduate students are steadier than assistant professors Surprises (2/2)

Require navigation systems for UAVs above 18 lbs to be certified “spoof-resistant” Require navigation and timing systems in critical infrastructure to be certified “spoof- resistant” “Spoof resistant” defined by ability to withstand or detect civil GPS spoofing in a battery of tests performed in a spoofing testbed Recommendations

Spoofing Defenses Cryptographic Non-Cryptographic Stand-Alone Networked J/N Sensing (Ward, Scott, Calgary) SSSC or NMA on WAAS (Scott, UT) All-Signals Defense (DARPA, BAE, UT) Single-Antenna Spatial Correlation (Cornell, Calgary) SSSC on L1C (Scott) NMA on L2C, L5, or L1C (MITRE, Scott, UT) Signal Forensics (TENCAP, Ledvina, Torino, UT) Multi-Antenna Defense (Keys, Montgomery, DLR, Stanford) P(Y) Cross-Correlation (Stanford, Cornell)

Public-Key Signal Authentication: Receiver Perspective Code Origin Authentication Code Timing Authentication Wesson, K., Rothlisberger, M., and Humphreys, T. E., “Practical Cryptographic Civil GPS Signal Authentication,” NAVIGATION: The Journal of the Institute of Navigation, to be published.

Security Code Estimation and Replay Detection Inside the Spoofer: Security Code Chip Estimation Inside the Defender: Detection Statistic Based on Specialized Correlations

Security Code Estimation and Replay Detection: Hypothesis Testing During an Attack Humphreys, T. E., “Detection Strategy for Cryptographic GNSS Anti-Spoofing,” IEEE Transactions on Aerospace and Electronic Systems, to be published.

Operational Definition of GNSS Signal Authentication GNSS signal is declared authentic if since some trusted initialization event: 1.logical output S has remained low, and 2.logical output H 1 has remained low, and 3.output P D has remained above an acceptable threshold

Hard to characterize the null hypothesis for a crypto defense on a dynamic platform – hard to keep false alarm rate under control All crypto defenses ineffective against near-zero- delay meaconing (entire band record and playback) timing attacks Civil GPS crypto defenses will probably be funded and implemented just before the heat death of the universe Is envisioning widespread adoption of non-crypto defenses just wishful thinking? Nagging Concerns

radionavlab.ae.utexas.edu